virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-24 13:56:33 +02:00
Code Issues Releases Activity

indeo3: fix motion vector validation

Browse Source 
The index of the motion vector has to be checked before being
multiplied by 2 for the array index.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Hendrik Leppkes 2012-01-25 17:37:26 +01:00 committed by Michael Niedermayer
parent 5cb57a16ed
commit 6071644287
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/indeo3.c
View File

@ -772,13 +772,12 @@ static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
/* get motion vector index and setup the pointer to the mv set */ /* get motion vector index and setup the pointer to the mv set */
if (!ctx->need_resync) if (!ctx->need_resync)
ctx->next_cell_data = &ctx->gb.buffer[(get_bits_count(&ctx->gb) + 7) >> 3]; ctx->next_cell_data = &ctx->gb.buffer[(get_bits_count(&ctx->gb) + 7) >> 3];
if(ctx->mc_vectors) mv_idx = *(ctx->next_cell_data++);
mv_idx = *(ctx->next_cell_data++) << 1;
if (mv_idx >= ctx->num_vectors) { if (mv_idx >= ctx->num_vectors) {
av_log(avctx, AV_LOG_ERROR, "motion vector index out of range\n"); av_log(avctx, AV_LOG_ERROR, "motion vector index out of range\n");
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
curr_cell.mv_ptr = &ctx->mc_vectors[mv_idx]; curr_cell.mv_ptr = &ctx->mc_vectors[mv_idx << 1];
curr_cell.tree = 1; /* enter the VQ tree */ curr_cell.tree = 1; /* enter the VQ tree */
UPDATE_BITPOS(8); UPDATE_BITPOS(8);
} else { /* VQ tree DATA code */ } else { /* VQ tree DATA code */